Poor maintenance, poor engineering and lack of emergency training caused a catastrophic accident at one of the world’s largest hydropower plants, in which 75 perished.

Unusual load demands were made on the Sayano Shushenkaya hydro plant in Siberia, on 16 August 2009. A few hours later, one of the plant’s hydro-generators exploded and within seconds thousands of litres of water flooded the power house. Some 75 people were drowned or lost, the Siberian grid dropped 10 per cent of its capacity, oil poured into the Yensei river, generators and transformers were destroyed and concrete structures severely damaged.The problem began in a control room at the nearby Bratskaya 1,400MW hydro plant during the night before the accident. A fire caused its grid-regulating function to be transferred to Sayano Shushenkaya. The turbo generators that took up the load, particularly unit 2, were old and badly maintained. The generally accepted view is that the water-hammer in the penstock caused this unit to fail and literally blow up, throwing the generator and turbine many metres into the air, thus allowing water from the reservoir to flood the powerhouse.

When fully commissioned, the Sayano Shushenkaya hydropower comprised ten 640MW units producing 24,000GWh a year at a 42 per cent capacity factor. The units were fed from a reservoir on average about 220m deep, created by a dam 245m high and 1km long across the Yenesi River. It was one of four hydroelectric stations with a joint capacity of 20,700MW, jointly providing more than two-thirds of the East Siberian electrical demand. It was the sixth largest station in the world and the biggest in Russia.

Aluminium smelters

The grid feeds four large aluminium smelters, whose loads fluctuate wildly. Normally Bratskaya provided the regulation of the network and Sayano Shushenkaya the base load. The long-term aim of the plant’s owners, RusHydro, was to supply electricity to more than the smelters and interconnect with nearby grids, which made it important to regulate the grid. But although Bratskaya was able to carry this out, Sayano was not.The load fluctuations were severe and rapid, a characteristic of aluminium smelters. Incipient faults, both electrical and mechanical – and there were many at Sayano – soon become active. Had the machines continued to supply the base load, the accident would not have happened at that particular time, but it was bound to happen sooner or later.

None of the machines at Sayano Shushenkaya were suitable for prolonged regulation service but, of the ten machines, unit 2 was selected as the best available and it was decided to use it for frequency control. One unit was on standby, another was under maintenance, and the remainder continued to supply base load. Unit 2 was near the end of its recommended useful life of 30 years – by August 2009 it had been operating on and off for 29 years and nine months.

However, it had been recently maintained and was thought to be the most reliable unit, although it transpires that this maintenance was grossly inadequate.

Operating demands were onerous. In the 13 minutes before the accident the unit had swung from 170MW to 600MW six times against a rated output of 640MW. Every time the load changed, the machine had to pass through the so-called ‘unstable zone’ when vibrations were higher than normal. In addition, the reservoir head was 212m as opposed to the design level of 197m. This provided the optimum conditions for mechanical failure. The turbine was frequently rotating in an unstable zone, with the added stress of decelerating and accelerating under a head 15m above the design level.

Although a new vibration trip for unit 2 had been installed, it was not working. Weekly readings of vibration from April to 11 August showed that in the week before the accident vertical displacements had reached 1,500µm, more than 700 per cent higher than the allowable maximum of 200µm. At the point of failure it was 525 per cent higher. Three months earlier the level was 250µm. Had the trip been working, the machine would have automatically dropped out at this point or soon after.

The bolts holding the head cover of the turbine in place played a critical part in the accident. The thrust bearing for the generator and the generator itself were immediately above the turbine head cover and the water hammer would have been enough to shear them, lifting the head cover and turbine above it and causing water to flood into the power house.

Eighty of the 80mm head cover bolts were in place when the machine was commissioned. At the time of the accident, at least six bolts were without nuts. When new, each bolt would have been able to carry a load of 60t. Subsequent laboratory tests on 49 bolts recovered showed that 41 had fatigue cracks, 49 had lost 65 per cent of their effective cross-section, and the remainder had lost anything from 80 to 96 per cent. Like the unit itself, they were also at the end of their working life with three months to go before reaching their 30-year end-of-service date.

One alternative view is that the bolts were there principally to seal the flange of the head cover to the turbine body, rather then counter all of the thrust on the cover. There was a gasket between the turbine body and the cover, held in place by two flanges and clamped together by the bolts. The flange itself was relatively narrow, and possibly its main purpose, with the bolts, was to provide a water-tight connection. Downward thrust on the head cover was provided by the generator and thrust bearing above it; possibly its weight was assumed to be adequate to resist water pressure irrespective of the bolts.

Photographs of the actual failure show that the head cover was lifted vertically by the in-rushing water, rather than to one side or the other. The explosion was so rapid and forceful that the bolts failed simultaneously rather than sequentially as might be expected as they were all at different states of disrepair. If their designed function was simply to ensure a good seal, then they could not be expected to hold the head cover in place, even if they had been in pristine condition.

The head cover burst off at 0813, some nine hours after the unit started its frequency control duties. Within seconds water burst through the machine and into the machine hall, throwing the turbine, generator and thrust bearing, weighing nearly 1,600t many metres into the air and flooding the powerhouse. From that point on, the survivors had only torches to try and recover the situation. The powerhouse was now flooded and 75 people were either drowned or killed by falling debris.

Inadequate back-up

This loss of life might have been lower if there had been an emergency protocol established, but there had never been any evacuation drills, and the emergency backup generator was disabled. The lack of backup power also contributed to the problem; the plant was in total darkness.

Subsequently it was found that units 2, 7 and 9 had been destroyed, turbines 1 and 3 seriously damaged and, 4 and 5 slightly damaged. Units 8 and 10 were damaged internally, but unit 6 was intact; the roof of the turbine room had collapsed; transformers 1 and 2 had been destroyed, while transformers 3, 4 and 5 were in a satisfactory condition.

Large sections of the powerhouse were destroyed. In part this was caused by the heavy machinery being thrown against the walls and in part by the force of water. There was incipient danger of further damage, because the dam itself had been subject to the same inadequate maintenance regime as the rest of the plant. Rather than the planned nine-year construction period, it had taken 27 years. During this time, political considerations in the then-USSR, dictated the choice of managers and distorted the recruitment of technically qualified engineers needed to operate this and other hydro plants in the region. Some senior managers may now be facing trial for corruption.

Immediately after the collapse of the USSR clear lines of responsibility were not properly established so that at this time Sayano and many other plants were suffering from a lack of impartial inspections and an inadequate planned maintenance regime. Russia’s emergencies minister Sergei Shoigu has described the accident as “the biggest man-made emergency in the past 25 years.”

A similar accident occurred in 1992 when a head cover failed on unit 1 of the Grand Rapids Generating Station, operated by Manitoba Hydro. It caused flooding in the lower levels of the power house; the problem was subsequently traced to the bolts in the head cover, which apparently failed.

Other critical factors

The loss of emergency power crippled the remedial actions in the few hours after the accident; the inlet gates to the turbine penstock had to be closed to stop more water coming in. It took nearly an hour to close them and it had to be done manually.

With the inlet gates closed no more water was flowing in from penstocks, but the outlet gates of the turbines located at the bottom of the reservoir were still open. Again, there was no emergency supply to close them so divers were sent down to close the gates manually.At this point, water could no longer enter the powerhouse but it was still entering the reservoir and rising slowly. It could not escape because the ten spillway gates situated at the crest of the dam that allow excess water to be channelled away were closed. Normally, to discharge excess flow they would be raised by a gantry crane, but because there was no emergency supply it could not operate and the gates could not be operated manually.

With water outflow blocked it was estimated that there was just enough spare capacity in the reservoir for two days’ inflow before overtopping. This has serious consequences for a dam because it may damage and weaken the downstream face or ancillary equipment. At Sayano Shushenkaya the powerhouse was sited at the base of the dam on the downstream side and could have suffered further damage if overtopping occurred.

The turbine blades were in poor condition and repairs were taking place at 10,000 hour intervals. They continually developed cracks, some of them 130mm deep. Metal loss caused by cavitation, often present in turbine blades and ships’ propellers, were 12mm deep and the material loss was made up by welding. Although the accident could not be attributed to the condition of the blades, they must have compounded the vibration problems. In addition, their poor maintenance was symptomatic of the general standard throughout the station.

The official report says that recommendations to replace them had already been made, but had been ignored. After about 50,000 hours of operation, the extent of the damage to the blades was increasing rapidly, and more people were required to carry out the repair work, but, according to one of the official reports, “the repairs were not always completed”.

A diesel generator was brought to the site 12 hours after the accident; the crane was energised and the spillway gates were opened. The reservoir level could now be maintained at a safe level. The emergency power supply also allowed water to be pumped out of the powerhouse, but not immediately because pumps installed at the site were unable to operate submerged. New pumps had to be brought in to support the original system.

But while this procedure had prevented overtopping, this led to two more concerns. Generally water from spillways discharges into a basin that is designed to dissipate the energy before it continues downstream. At Sayano the dissipating basin had been damaged previously and there were concerns that it too might collapse under the sustained discharge. In the immediate aftermath there was nothing that could be done although ultimately the basin remained intact until remedial measures were completed.

The second concern was the potential for ice formation, which would happen as winter drew in. Because the spillway was the only way that excess water could be discharged until repairs had been completed, the speed and energy of the water flowing through it threw water particles off into the air that rose to a height of nearly 200m. These fell down in the form of snow, some of which turned to ice, and large blocks of snow and ice formed, some 25m thick. This reduced water discharge from the reservoir and machinery had to be used to break the ice 24 hours a day. At one stage, hot water from fire hoses was used to reduce the build-up.

After the accident

More than 2,700 people carried out search and rescue work; 11 aircraft and 15 boats were also involved. About 5,000m3 of debris were cleared, more than 277,000m3 of water pumped out and 324.2t of oily emulsion collected from the reservoir and river. *

An electrical angle

MWH Global has several plausible failure scenarios, one of which is that the failure was centred on the generator, rather than the turbine. The generator failure theory is based on the fact that three generators failed catastrophically with major similarities: the stator frames were sheared off their sole plates; the stator core itself was ripped off the frame; the upper guide bearing bracket was sheared completely off; and the rotor pole copper is gone on all three machines.

The generator theory is based on the visual evidence on units 7 and 9 and its similarity to unit 2. There are two different generator failure scenarios. The first is that a short-circuit in the generator resulted in torsional forces large enough to rip the stator frame off its sole plates. The consequence of the stator ripping off its sole plates is that, given the upper guide bearing sits on the stator frame, once the stator ripped free all lateral rotation stability support for the massive machine above the head cover was lost. The second scenario is that in an overspeed event after the generator breaker opened, the rotor poles or the copper from them made impact with the stationary stator, mechanically ripping the stator off its sole plates. Again, once the stator frame was gone the stability from upper guide bearing was lost.

Why did the head cover bolts fail on unit 2 but not units 7 and 9? This is potentially easily explained by the fact that unit 2 had been running with severe vibration since being overhauled and the vibration resulted in fatigue cracks in the unit 2 bolts. Once the upper bearing was gone on unit 2, all of the side load forces from the torsional or impact in the generator caused a reactive bending and torsional force on the lower guide bearing mounted on the head cover. With fatigue-cracked bolts, the head cover connection could not withstand the forces. On units 7 and 9, the head cover connection held.